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DETAILED ACTION 

1. Amendment received on 05/25/2005 has been entered. Claims 1-87 are 
previously presented. 

2. Claims 1-87 are presented for examination. 

Priority 

3. No priority claims have been made. 

4. The effective filing date for the subject matter defined in the pending claims in 
this application is 10/25/2000. 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

6. Claims 1-87 rejected under 35 U.S.C. 103(a) as being unpatentable over Ennis, 
Jr. et al. (Patent Number 5,867,483), hereinafter referred to as Ennis, in view of Tarns et 
al. (U.S. Patent Number 6,327,620), hereinafter referred to as Tarns, in view of Schaffer 
(U.S. Patent Number 6,21 9,050), and further in view of Hernandez et al. (U.S. Patent 
Number 6,208,977), hereinafter referred to as Hernandez. 

7. Regarding claim 1, Ennis disclosed a method of monitoring a packet-switched 

network using traffic logs (Abstract, Figures 1 and 11), comprising: 

creating a histogram file (Figures 13-16, column 4 lines 45-64, column 5 lines 13- 
22); 
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generating a traffic log at a first location within the network, the traffic log 
containing a plurality of values detected from data transmission (column 2 lines 
16-30, column 7 lines 22-28, column 8 lines 11-16); 

transferring the traffic log from the first location [short term database] to a second 
location [long term database] (Figure 10, column 14 lines 8-33); 

storing the traffic log generated by the network at the second location [long term 
database] (Figure 10, column 2 lines 16-30); 

analyzing the stored traffic log to determine the time of creation of the traffic log 
and the network entry and exit points of the packet (Figures 11, 13-16, column 3 
lines 58-67, column 4 lines 45-64). 

8. Ennis taught the invention substantially as claimed. However, Ennis did not 
specifically teach updating the histogram file using at least the time of creation of the 
traffic log and at least one of the entry and exit points of the packet. 

9. Ennis suggested exploration of art and/or provided a reason to modify the 
method with the updating feature (column 3 lines 58-64, column 4 lines 45-54). 

10. Tarns disclosed a method of monitoring a packet-switched network using traffic 
logs comprising the step of updating the histogram file using at least the time of creation 
of the traffic log and at least one of the entry and exit points of the packet (Figures 8 and 

10, column 35-65). 

11. It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the method of Ennis with the teachings of Tarns to 
include the updating feature in order to appropriately capture data transmission system 
activity (Ennis, column 9 lines 11-15) since network traffic monitoring generally being 
done over the specified time interval (Tarns, column 3 lines 44-45). 
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12. The combination of Ennis and Tarns taught the invention substantially as 
claimed, however, the combination of Ennis and Tarns did not teach the step of 
generating a traffic log at a first location within the network based upon detection of a 
packet, the traffic log containing a plurality of values detected from the packet including 
a network entry point and a network exit point of the packet. 

13. Tarns suggested exploration of art and/or provided a reason to modify the 
method of Tarns with generating a traffic log where each traffic log contains values such 
as network entry point and a network exit point of the packet for an individual packet 
(column 5 lines 1-9, column 13 lines 35-42, Table 2). 

14. Schaffer taught a method of generating a traffic log at a first location within the 
network based upon detection of a packet, the traffic log containing a plurality of values 
detected from the packet including a network entry point and a network exit point of the 
packet (Schaffer, Abstract, column 1 lines 17-35, column 2 lines 24-31, column 6 lines 
5-27). 

1 5. It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the combined method of Ennis and Tarns with the 
teachings of Schaffer to include a step of generating a traffic log where each traffic log 
contains values such as network entry point and a network exit point of the packet for 
an individual packet since for cases where an application's network behavior must be 
understood, the ability of capture and display data associated with an individual packet 
is desired because in multi-tier applications, it is often difficult to understand the source 
and destination of a packet (Schaffer, column 1 lines 54-64, column 2 lines 10-17). 
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16. Ennis suggested exploration of art and/or provided a reason to modify the 
combined method Ennis, Tarns, and Schaffer with the step of generating billing data 
from the stored traffic logs (column 2 lines 64-column 3 lines 8, column 5 lines 23-40, 
column 24 lines 51-59). 

17. Hernandez disclosed a method for determining billing information for use of a 
network comprising generating billing data for network use at the second location using 
information from the stored traffic logs (Title, Abstract, Figures 1B, 4A, column lines 1- 

18. column 3 lines 31-67, column 4 line 65-column 5 line 7). 

18. It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the combined method of Ennis, Tarns, and Schaffer with 
the teachings of Hernandez to include a step of generating billing data for network use 
at the second location using information from the stored traffic logs in order to make 
users accountable for their usage level thereby encouraging more efficient use of 
network resources (Hernandez, column 2 lines 66-column 3 lines 4). 

19. As the rejection reads, the combination of Ennis, Tarns, Schaffer, and Hernandez 
taught all the limitations as claimed in claim 1. 

20. Regarding claim 2, Tarns disclosed a method wherein the histogram file is a flat 
file, whereby direct and rapid access to stored data is effected (column 2 lines 16-30). 

21. Regarding claim 3, Ennis disclosed a method wherein two histogram files are 
created, a first histogram being representative of traffic being passed into the network 
and a second histogram being representative of the traffic being passed from the 
network (column 4 lines 45-59, column 7 lines 23-52). 
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22. Regarding claim 4, Ennis disclosed a method wherein the histogram file is 
representative of traffic passing to a host connected to the entry or exit point (Figure 1 , 
column 7 lines 18-40). 

23. Regarding claim 5, Ennis disclosed a method further comprising repeating steps 
(b) - (d) for at least a predetermined period (column 4 lines 45-64, column 15 lines 31- 
45). 

24. Regarding claim 6, Tarns and Schaffer disclosed a method further comprising 
analyzing the traffic log to determine state information of a packet associated with the 
traffic log, and updating the histogram with the state information (Tarns, column 7 lines 
22-41; Schaffer, Abstract, column 3 lines 23-29). 

25. Regarding claim 7, Ennis and Tarns combined disclose a method wherein the 
histogram plots packets per minute versus time (Ennis, Figures 11 and 13-16; Tarns, 
column 3 lines 44-52). 

26. Regarding claim 8, Ennis disclosed a method further comprising broadcasting 
from a server computer data representative of the histogram to a client computer 
(column 15 lines 31-45). Tarns also disclosed this limitation (column 6 lines 39-45). 

27. Regarding claim 9, Ennis disclosed a method wherein the network is a packet 
network [Mobitex network] (Title, Abstract). (Note: Mobitex technology is a well-known 
packet data network). 

28. Regarding claim 10, Ennis disclosed a method further comprising displaying a 
histogram based on data in the histogram file (Figures 11 and 13-16, column 6 lines 9- 
37, column 17 lines 6-24). 
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29. Regarding claim 1 1 , Ennis and Tarns disclosed a method further comprising 
creating at least one histogram for each host of the network (Ennis, Figures 1 1 and 13- 
16, column 17 lines 25-53; Tarns, Tables 1-2). 

30. Regarding claim 12, Ennis disclosed a method further comprising selecting for 
display the at least one histogram for a particular host (Figures 1 1 and 13-16, column 
17 lines 24-53). 

31. Regarding claim 13, Tarns disclosed a method further comprising monitoring a 
central location of the network for new traffic logs (Figures 5-6 and 8, column 13 lines 
19-42). 

32. Regarding claim 14, Ennis, Tarns, Schaffer, and Hernandez combined disclose a 
method of monitoring packet traffic through a node of a packet-switched network using 
traffic logs, comprising: 

(a) creating a histogram file for at least one node in the network (Ennis, Figures 
13-16, column 4 lines 45-64, column 5 lines 13-22); 

(b) generating a traffic log at a first location within the network based upon 
detection of a packet, the traffic log containing a plurality of values detected from 
the packet including a network entry point and a network exit point of the packet 
(Schaffer, Abstract, column 1 lines 17-35, column 2 lines 24-31, column 6 lines 5- 
27); 

(c) transferring the traffic log from the first location [short term database] to a 
second location [long term database] (Ennis, Figure 10, column 14 lines 8-33); 

(d) storing the traffic log generated by the network at the second location [long 
term databases] (Ennis, Figure 10, column 2 lines 16-30); 

(c) analyzing the stored traffic log to determine the time of creation of the traffic 
log and the network entry and exit points of the packet (Ennis, Figures 11, 13-16, 
column 3 lines 58-67, column 4 lines 45-64); 
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(0 determining a network path between the entry and exit points of the packet 
(Ennis, Figures 11, 13-16, column 3 lines 58-67, column 4 lines 45-64, column 7 
lines 43-52); 

(g) determining whether the node falls along the network path (Ennis column 7 
lines 43-52); 

(h) updating the histogram file using at least the time of creation of the traffic log 
when the node falls along the network path (Tarns, Figures 8 and 10, column 25 
lines 50-65; Ennis column 7 lines 43-52, column 8 lines 11-15); and 

(i) generating billing data for network use at the second location using information 
from the stored traffic logs (Hernandez, Title, Abstract, Figures 1B, 4A, column 
lines 1-18, column 3 lines 31-67, column 4 line 65-column 5 line 7). 

33. Regarding claim 15, Tarns disclosed a method wherein the histogram file is a flat 
file (column 2 lines 16-30). 

34. Regarding claim 16, Ennis disclosed a method wherein two histogram files are 
created, a first histogram being representative of traffic being passed towards a higher 
level of the network and a second histogram being representative of the traffic being 
passed towards a lower level of the network or outside the network (column 4 lines 45- 
59, column 7 lines 23-52). 

35. Regarding claim 17, Ennis disclosed a method further comprising repeating steps 
(b) - (f) for at least a 24-hour period (column 4 lines 45-64, column 15 lines 31-45). 

36. Regarding claim 18, Ennis and Tarns combined disclose a method wherein the 
histogram plots packets per minute versus time (Ennis, Figures 11 and 13-16; Tarns, 
column 3 lines 44-52). 

37. Regarding claim 19, Ennis disclosed further comprising broadcasting, from a 
server computer, data representative of the histogram to a client computer (column 15 
lines 31-45). Tarns also disclosed this limitation (column 6 lines 39-45). 
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38. Regarding claim 20, Ennis disclosed wherein the network is a packet network 
[Mobitex network] (Title, Abstract). (Note: Mobitex technology is a well-known packet 
data network). 

39. Regarding claim 21, Ennis disclosed further comprising displaying a histogram 
based on data in the histogram file (Figures 11 and 13-16, column 6 lines 9-37, column 
17 lines 6-24). 

40. Regarding claim 22, Ennis and Tarns disclosed further comprising creating at 
least one histogram for each node of the network (Ennis, Figures 11 and 13-16, column 
17 lines 25-53; Tarns, Tables 1-4A). 

41 . Regarding claim 23, Ennis disclosed further comprising selecting for display the 
at least one histogram for a particular node (Figures 1 1 and 13-16, column 17 lines 24- 
53). 

42. Regarding claim 24, Tarns disclosed further comprising monitoring a central 
location of the network for new traffic logs (Figures 5-6 and 8, column 13 lines 19-42). 

43. Regarding claim 25, Ennis, Tarns, Schaffer, and Hernandez combined disclose a 
method of monitoring packet traffic through a link connecting two nodes of a 
packet-switched network using traffic logs, comprising: 

(a) creating a histogram file for at least one link in the network (Ennis, Figures 
13-16, column 4 lines 45-64, column 5 lines 13-22); 

(b) generating a traffic log at a first location within the network based upon 
detection of a packet, the traffic log containing a plurality of values detected from 
the packet including a network entry point and a network exit point of the packet 
and a number of bytes of the packet (Schaffer, Abstract, Figure 1, column 1 lines 
17-35, column 2 lines 24-31, column 6 lines 5-27); 
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(c) transferring the traffic log from the first location [short term database] to a 
second location [long term database] (Ennis, Figure 10, column 14 lines 8-33); 

(d) storing the traffic log generated by the network (Ennis, Figure 10, column 2 
lines 16-30); 

(c) analyzing the traffic log to determine the time of creation of the traffic log and 
the network entry and exit points of the packet(Ennis, Figures 11, 13-16, column 
3 lines 58-67, column 4 lines 45-64); 

(f) determining a network path between the entry and exit points (Ennis, Figures 
11, 13-16, column 3 lines 58-67, column 4 lines 45-64, column 7 lines 43-52); 

(g) determining whether the link falls along the network path (Ennis column 7 
lines 43-52); 

(h) determining a number of bytes carried by the packet associated with the 
traffic log (Shaffer, Figure 1, column 48-54); 

(i) updating the histogram file using at least the time of creation of the traffic log 
when the node falls along the network path and the number of bytes when the 
link falls along the network path (Tarns, Figures 8 and 10, column 25 lines 50-65; 
Ennis column 7 lines 43-52, column 8 lines 11-15); and 

(j) generating billing data for network use at the second location using information 
from the stored traffic logs (Hernandez, Title, Abstract, Figures 1B, 4A, column 
lines 1-18, column 3 lines 31-67, column 4 line 65-column 5 line 7). 

44. Regarding claims 26-35, the limitations are closely similar to the limitations of 
claims 15-24, and thus are rejected using the same rationale. 

45. Regarding claim 36, Ennis, Tarns, and Shaffer combined disclose a method of 
monitoring the operations of a packet-switched network, the network automatically 
generating a traffic log when a packet enters or exits the network by detecting values 
from the packet (Tarns, column 13 lines 35-38; Schaffer, Abstract), the method 
comprising: 

(a) detecting when a new traffic log is available at a network control center 
(Ennis, column 3 lines 41-67; Tarns, Figures 5 and 8); 
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(b) downloading the new traffic log to a server computer that maintains a plurality 
of histogram files (Schaffer, Figure 8 sign 114, column 8 lines 43-60); 

(c) updating at least one histogram file of the server computer using information 
available from the new traffic log by analyzing the new traffic log to determine 
one or more values detected from the packet that are stored by the new traffic 
log that are relevant to the at least one histogram (Ennis, Figures 8 and 10, 
column 35-65; Schaffer, column 8Jines 43-60); 

(d) deleting the new traffic log (Tarns, column 4 lines 29-43, column 25 lines 35- 
49); 

(e) making the updated at least one histogram file available to a client computer 
from the server computer (Ennis, column 15 lines 31-45; Schaffer, column 8 lines 
61-67); and 

(f) generating billing data for network use at the second location using 
information from the stored traffic logs (Hernandez, Title, Abstract, Figures 1B, 
4A, column lines 1-18, column 3 lines 31-67, column 4 line 65-column 5 line 7). 

46. Regarding claims 37-41 , the limitations are closely similar to the limitations of 
claims 2-13 & 15-24, thus these claims are rejected using the same rationale. 

47. Regarding claim 42, Tarns disclosed a method wherein the updating step 
comprises incrementing a value in the histogram file (column 2 lines 42-59). 

48. Regarding claim 43, Ennis, Tarns, and Schaffer combined disclose a method of 
analyzing the performance of a packet-switched network, the network automatically 
generating a traffic log, each time a packet exits the network, each traffic log including 
at least the time the traffic log was created, the addresses of the packet sender and 
packet recipient, and the entry and exit network nodes (Schaffer, Abstract, Figure 1, 
column 1 lines 13-35, Tarns, Figure 5, column 4 lines 17-24) the method comprising the 
steps of: 

(a) collecting at a centralized location a plurality of traffic logs from the network, 
with each traffic log containing information relevant to a different packet that has 
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exited the network (Ennis, Abstract, column 3 lines 41-67, column 4 lines 45-67; 
Tarns, Table 2); 

(b) analyzing each of the plurality of traffic logs to determine information about 
each of the packets that have exited the network (Schaffer, column 1 lines 17-35, 
column 6 lines 5-26); 

(c) automatically generating a plurality of histograms, each histogram being 
based on information gleaned from the plurality of traffic logs about the packets 
that have exited the network; and 

(d) generating billing data for network use at the second location using 
information from the stored traffic logs (Hernandez, Title, Abstract, Figures 1B, 
4A, column lines 1-18, column 3 lines 31-67, column 4 line 65-column 5 line 7), 

wherein at least one histogram is representative of packet traffic passing 
through a host connected to the network (Ennis, Figures 11 and 13-16, 
column 4 lines 45-67, column 14 lines 1-33). 

49. Regarding claims 44-48, the limitations are closely similar to the limitations of 
claims 2-3, 8, 12, and 33. 

50. Regarding claims 49-59, the system corresponds directly to the method of claims 
1-13, and thus these claims are rejected using the same rationale. 

51 . Regarding claims 60-68, the system corresponds directly to the method of claims 
14-16 & 18-23, and thus these claims are rejected using the same rationale. 

52. Regarding claims 69-77, the system corresponds directly to the method of claims 
25-27 & 29-34, and thus these claims are rejected using the same rationale. 

53. Regarding claims 78-83, the system corresponds directly to the method of claims 
36-41, and thus these claims are rejected using the same rationale. 

54. Regarding claims 84-87, the system corresponds directly to the method of claims 
43 & 46-47, and thus these claims are rejected using the same rationale. 
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55. Since all the limitations of the claimed invention were disclosed by the 
combination of Ennis, Tarns, Schaffer, and Hernandez, claims 1-87 are rejected. 

Response to Arguments 

56. Applicant's arguments received on 05/25/2005 with respect to claims 1-87 have 
been considered but are moot in view of the new ground(s) of rejection. 

57. As the rejection reads, Examiner asserts that the combination of these teachings 
render the claimed invention obvious. 

Conclusion 

58. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. Refer to the enclosed PTO-892 for details. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Tarn (Jenny) Phan whose telephone number is (571) 
272-3930. The examiner can normally be reached on M-F 9:00-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David Wiley can be reached on (571) 272-3923. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
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Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

MARC D. THOMPSON 
PRIMARY EXAMINER 

5.7/. 272. 3ff 32 

Tarn T. Phan 
July 25, 2005 



